web-cache-deception

A security-testing playbook for web cache deception and web cache poisoning. It applies when a CDN, reverse proxy, or application caching layer may serve sensitive authenticated content to other users because of path confusion or cache key manipulation. The skill draws a clear distinction between the two attack families: cache deception steals authenticated data, while cache poisoning serves malicious content to other users.

For cache deception, the methodology is to identify cacheable path patterns (CDNs commonly cache by extension such as .css, .js, .png, or .json), test path confusion by appending a static extension to an authenticated endpoint, verify caching by comparing X-Cache MISS then HIT and Age headers across an authenticated request and an unauthenticated one, and then deliver the crafted URL to a victim. It highlights that the vulnerability arises because the CDN and the application normalize paths differently, and it covers path-separator tricks using semicolons, encoded slashes, and trailing dots or spaces.

For cache poisoning, it focuses on unkeyed request inputs. Cache keys typically include Host, path, and query string but not headers like X-Forwarded-Host, X-Forwarded-Scheme, or X-Original-URL, so reflecting these into a cached response can inject attacker-controlled links, meta tags, or scripts affecting all users. A defense section recommends caching only explicitly static paths, setting Cache-Control no-store or private on authenticated endpoints, using Vary: Cookie, including reflected headers in the cache key, and stripping unknown headers at the edge. An advanced reference adds CDN-specific behavior for Cloudflare, CloudFront, Akamai, Varnish, and Fastly, plus Vary and cache-partitioning topics, and a testing checklist ties it together.